@@ -165,0 +167,4 @@
+
+Before any finding is posted, WuMing fact-checks it: a dedicated LLM call receives the finding plus the full content of the changed file and decides whether the file actually contradicts the finding's factual claims. Only findings the file demonstrably contradicts are dropped — the verifier never judges style, importance, or severity, and it only sees the changed file itself, so claims about other files ("no test exists") are not verified.
+
+Verification is fail-open: a provider error or unparseable verdict keeps the finding. Files whose content cannot be fetched, or that exceed 2000 lines, skip verification entirely. The pass adds one LLM call per finding (at most 4 run concurrently), after the cheap filters — severity floor, line-in-diff, deduplication — so LLM spend goes only to findings that would otherwise be posted. Set `WUMING_VERIFY=false` to disable.

@@ -3,3 +3,3 @@
 ---
 
-wuming 0.10.0
+wuming 0.11.0

@@ -0,0 +78,4 @@
+    if verdict not in _VALID_VERDICTS:
+        return None
+    reason = item.get("reason")
+    return (verdict, str(reason) if reason else "")

@@ -0,0 +127,4 @@
+    except Exception as exc:
+        logger.warning(
+            "verifier call failed — keeping finding",
+            extra={"path": comment.path, "line": comment.line, "error": repr(exc)},

@@ -0,0 +176,4 @@
+        return_exceptions=True,
+    )
+    for path, content in zip(to_fetch, fetched, strict=True):
+        if isinstance(content, BaseException):

@@ -0,0 +179,4 @@
+        if isinstance(content, BaseException):
+            logger.warning(
+                "file content fetch failed — skipping verification for file",
+                extra={"path": path, "error": repr(content)},

@@ -0,0 +46,4 @@
+    expect(parse_verdict(raw)).to_equal(expected)
+
+
+@test("parse_verdict returns None for anything that is not a clean verdict").cases(

@@ -158,10 +158,17 @@ See the [Forgejo/GitHub Actions guide](https://wuming.marvin8.zone/getting-start
 | `WUMING_PROGRESS` | — | `true`/`1` force on; `false`/`0` force off; when unset or empty, auto-detects: enabled when stdout is a TTY and `CI` env var is absent |
 | `WUMING_MAX_DIFF_LINES` | `0` | Maximum raw diff size in lines. When the diff exceeds this value and it is greater than 0, WuMing posts a single plain PR comment explaining the PR is too large to review automatically, then exits without posting inline comments. Set to `0` to disable. |
 | `WUMING_MAX_FILE_LINES` | `0` | Maximum file size (in lines) for full-file context fetching. When greater than 0, WuMing fetches the complete content of each changed file from Forgejo and includes it in the agent's context, giving the model visibility beyond the diff hunks. Files exceeding this line count are excluded. Set to `0` (the default) to disable. |
+| `WUMING_VERIFY` | `true` | When `true`, each candidate finding is fact-checked against the changed file's full content before posting; findings whose factual claims the file contradicts are dropped. Verification is fail-open: provider errors keep findings. Set to `false` to disable. |

@@ -0,0 +120,4 @@
+    user_message = (
+        f"## Finding under review\n\n{_format_finding(comment)}\n\n"
+        f"## Full file content: {comment.path}\n\n"
+        f"```\n{file_content}\n```\n\n"

@@ -0,0 +136,4 @@
+        )
+        logger.debug(
+            "verifier call failure detail",
+            extra={"path": comment.path, "line": comment.line, "error": repr(exc)},

@@ -0,0 +187,4 @@
+    for path, content in zip(to_fetch, fetched, strict=True):
+        if isinstance(content, asyncio.CancelledError):
+            raise content
+        if isinstance(content, BaseException):

@@ -0,0 +194,4 @@
+            )
+            logger.debug(
+                "file content fetch failure detail",
+                extra={"path": path, "error": repr(content)},

@@ -0,0 +253,4 @@
+        A ``(kept, dropped)`` pair, both preserving input order.
+    """
+    if progress is not None:
+        progress.step_start("verify_findings", "Fact-checking findings…")

@@ -437,3 +438,28 @@ def test_reads_summary_comment(env: Annotated[None, Depends(clean_env)]) -> None
     with patch.dict("os.environ", {"WUMING_SUMMARY_COMMENT": "true"}, clear=False):
         config = load_config()
     expect(config.summary_comment).to_be_truthy()

@@ -101,6 +101,7 @@ tools/
 - `WUMING_PROGRESS` — `true`/`1` force on; `false`/`0` force off; when unset or empty, auto-detects: enabled when stdout is a TTY and `CI` env var is absent
 - `WUMING_MAX_DIFF_LINES` — integer; if the raw diff line count exceeds this value and it is > 0, posts a plain PR comment and exits without inline review (default: `0` = disabled)
 - `WUMING_MAX_FILE_LINES` — integer; when > 0, fetches the full content of each changed file from Forgejo and includes it in the agent's context (files exceeding this line count are excluded); (default: `0` = disabled)
+- `WUMING_VERIFY` — `true`/`false`; fact-check findings against full file content before posting (fail-open; skipped for unfetchable files and files over the hard-coded 2000-line cap); (default: `true`)

@@ -165,0 +167,4 @@
+
+Before any finding is posted, WuMing fact-checks it: a dedicated LLM call receives the finding plus the full content of the changed file and decides whether the file actually contradicts the finding's factual claims. Only findings the file demonstrably contradicts are dropped — the verifier never judges style, importance, or severity, and it only sees the changed file itself, so claims about other files ("no test exists") are not verified.
+
+Verification is fail-open: a provider error or unparseable verdict keeps the finding. Files whose content cannot be fetched, or that exceed 2000 lines, skip verification entirely. The pass adds one LLM call per finding (at most 4 run concurrently), after the cheap filters — severity floor, line-in-diff, deduplication — so LLM spend goes only to findings that would otherwise be posted. Set `WUMING_VERIFY=false` to disable.

@@ -90,6 +91,32 @@ def load_config() -> Config:
         dry_run=_parse_bool_flag(os.environ.get("WUMING_DRY_RUN")),
         verbose=_parse_bool_flag(os.environ.get("WUMING_VERBOSE")),
         summary_comment=_parse_bool_flag(os.environ.get("WUMING_SUMMARY_COMMENT")),
+        verify_findings=_parse_verify_enabled(os.environ.get("WUMING_VERIFY", "")),

@@ -99,6 +100,26 @@ async def _main() -> None:
                 raw_comments, position_maps, existing_markers, file_diffs
             )
 
+            if config.verify_findings and new_comments:

@@ -911,0 +988,4 @@
+        _verify_pipeline_env(),
+    )
+    expect(verify_mock.await_count).to_equal(1)
+    survivors = verify_mock.call_args.args[0]

@@ -101,6 +101,7 @@ tools/
 - `WUMING_PROGRESS` — `true`/`1` force on; `false`/`0` force off; when unset or empty, auto-detects: enabled when stdout is a TTY and `CI` env var is absent
 - `WUMING_MAX_DIFF_LINES` — integer; if the raw diff line count exceeds this value and it is > 0, posts a plain PR comment and exits without inline review (default: `0` = disabled)
 - `WUMING_MAX_FILE_LINES` — integer; when > 0, fetches the full content of each changed file from Forgejo and includes it in the agent's context (files exceeding this line count are excluded); (default: `0` = disabled)
+- `WUMING_VERIFY` — `true`/`false` (case-insensitive); fact-check findings against full file content before posting (fail-open; skipped for unfetchable files and files over the hard-coded 2000-line cap); parsing is fail-closed — any other value raises `ValueError` rather than falling back to the default; (default: `true`)

@@ -108,0 +147,4 @@
+            seeded_contents=seeded_contents,
+            progress=progress,
+        )
+    except Exception as exc:

@@ -911,0 +1000,4 @@
+    expect(verify_mock.call_args.kwargs["seeded_contents"]).to_equal({})
+    expect(verify_mock.call_args.kwargs["progress"]).not_.to_be_none()
+    expect(len(verify_mock.call_args.args)).to_equal(4)
+    post_body = str(review_post_calls[0].content)